EulerOS 2.0 SP15 : dnsmasq (EulerOS-SA-2026-2921)

According to the versions of the dnsmasq packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root...

EulerOS 2.0 SP15 : dnsmasq (EulerOS-SA-2026-2880)

According to the versions of the dnsmasq packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root...

Linux Distros Unpatched Vulnerability : CVE-2026-17583

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The affected Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because .fsa/.hid output files can be edited. An attacker could tamper with these...

MiracleLinux 9 : skopeo-1.22.2-7.el9_8 (AXSA:2026-1477:04)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1477:04 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive...

Tenable Sensor Proxy < 1.4.2 Code Injection (TNS-2026-21)

According to its self-reported version, the Tenable Sensor Proxy running on the remote host is prior to 1.4.2. It is, therefore, affected by code injection vulnerability as referenced in the TNS-2026-21 advisory. - A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code...

RHEL 9 : systemd (RHSA-2026:51134)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:51134 advisory. The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive...

RHEL 9 : RHEL AI 3.4 RPM runtime CVE fix - aom (Important) (RHSA-2026:51146)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:51146 advisory. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application...

PT-2026-68817

Name of the Vulnerable Software and Affected Versions h2 versions prior to 4.4.1 Description The software accepts request header blocks containing multiple Host headers and forwards all of them to the consuming application. When the consumer downgrades the connection from HTTP/2 to HTTP/1.1, the...

AlmaLinux 9 : yelp (ALSA-2026:47178)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:47178 advisory. yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications CVE-2026-13601 Tenable has extracted the...

The vulnerabilities of the functions qla2x00_update_optrom() and qla2x00_manage_host_stats() in the driver/scsi/qla2xxx/qla_bsg.c module of the SCSI device driver for the Linux operating system allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerabilities of the functions qla2x00updateoptrom and qla2x00managehoststats in the drivers/scsi/qla2xxx/qlabsg.c module of the SCSI device driver for the Linux operating system are related to operations involving resources after their expiration. Exploiting these vulnerabilities could all...

GHSA-279X-MWFV-VCQV Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host

Impact Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint ws://:/, subprotocol vite-hmr can call RPC methods,...

GHSA-GX4C-2HQX-CW2R rclone: S3 backend does not strip X-Amz-Security-Token on a same-host HTTPS->HTTP redirect

Vulnerability Details File: backend/s3/s3.go Lines: 1359-1380 functions s3CheckRedirect / s3RedirectCrossesHost Root Cause Commit e7b1eb774 released in v1.74.3 added a CheckRedirect policy for the S3 HTTP client whose purpose is to strip the X-Amz-Security-Token header the AWS STS session token...

GHSA-H4MF-4V27-HGGJ rclone: WebDAV Credentials Survive a Same-Host HTTPS-to-HTTP Redirect

Summary WebDAV's default redirect handling can replay Basic authorization and configured Cookie headers over plaintext HTTP after a same-host HTTPS-to-HTTP redirect. This was reproduced through the real backend. Unlike the low-impact STS token in rclone's published S3 redirect advisory, Basic...

rclone: WebDAV Credentials Survive a Same-Host HTTPS-to-HTTP Redirect

Summary WebDAV's default redirect handling can replay Basic authorization and configured Cookie headers over plaintext HTTP after a same-host HTTPS-to-HTTP redirect. This was reproduced through the real backend. Unlike the low-impact STS token in rclone's published S3 redirect advisory, Basic...

rclone: S3 Redirect Sanitization Omits IBM IAM Bearer Tokens and SSE-C Keys

Summary The S3 redirect callback strips X-Amz-Security-Token when a redirect changes scheme or host, but it does not strip IBM IAM bearer authorization or customer-provided encryption keys. Two independently validated paths remain: - a same-host HTTPS-to-HTTP redirect preserves Authorization:...

EUVD-2026-53615

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or...

CVE-2026-15788

A flaw was found in BuildKit. An untrusted user, when authoring a build on a Windows Container on Windows WCOW configured BuildKit daemon, can exploit a vulnerability in the cache mount source selector. This flaw allows the user to read arbitrary files from the host system, leading to information...

CVE-2026-55523

CVE-2026-55523 affects PraisonAI’s web_crawl() in versions 1.5.128–1.6.57. The function validates the initial URL but uses httpx.Client(follow_redirects=True) for redirects, failing to revalidate intermediate/final targets. An attacker can pass a URL that passes the first host check but redirects...

MAL-2026-13369 Malicious code in kepler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 672a1c042704318fe56d5da08c0f1d20b404274bd6ad339efc2f1c581d869d77 [email protected] declares its only runtime dependency, flag-serial-object-syntax, as an HTTP URL to a third-party host...

Malicious code in kepler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 672a1c042704318fe56d5da08c0f1d20b404274bd6ad339efc2f1c581d869d77 [email protected] declares its only runtime dependency, flag-serial-object-syntax, as an HTTP URL to a third-party host...